Paper/Archive/CVE-2025-59719

CVE-2025-59719

Fortinet FortiWeb — An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.…

EPSS 29%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 98.2.982 × 2019.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may allow an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

Affected

ProductAffectedFixed inSource

FortiWeb8.0.0–CNA

FortiWeb7.6.0 – 7.6.4–CNA

FortiWeb7.4.0 – 7.4.9–CNA

RUGGEDCOM APE1808all versions–siemens-SADP

Scores by source

fortinet (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-25-647 refcert-portal.siemens.com/productcert/html/ssa-864900.html